us-cert
Latest
Microsoft will fix an Internet Explorer security flaw under active attack
Mozilla isn't the only one grappling with a serious web browser security flaw. Microsoft has confirmed to TechCrunch that it will fix an Internet Explorer security exploit already being used for "limited targeted attacks." The vulnerability lets attackers corrupt memory used for the scripting engine in IE9, IE10 and IE11 in a way that would let the intruder run arbitrary code with the same permissions as the user, letting them hijack a PC. It's believed to be similar to the Firefox issue disclosed a week earlier.
You should update Firefox right now to fix a critical bug
If you have Firefox on your computer, you should update it right now. Mozilla has released security updates Firefox 67.0.3 and Firefox ESR 60.7.1 to fix a critical bug, which it says hackers are actively exploiting to take control of vulnerable systems. The US Cybersecurity and Infrastructure Security Agency also issued an alert urging users and system administrators to review Mozilla's security advisory and act accordingly -- in other words, update your browser.
North Korea-linked hacking group stole millions from ATMs
Lazarus, North Korea-linked hacking group that was behind the notorious WannaCry attack, managed to steal tens of millions of dollars from ATMs in Asia and Africa, according to a report from security firm Symantec. The hackers deployed malware called Trojan.FastCash and infected thousands of servers that communicate with ATMs. It then used that access to approve its own fraudulent transactions and withdraw money from the machines.
FDA tells hospitals to ditch IV pumps that can be hacked remotely
The Food and Drug Administration "strongly encourages" hospitals to stop using Hospira's Symbiq Infusion System, because it's vulnerable to cyberattacks that would allow a third party to remotely control dosages delivered via the computerized pumps. Unauthorized users are able to access the Symbiq system through connected hospital networks, according to the FDA and the Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team. ICS-CERT reported the vulnerability on July 21st and the FDA released its own safety alert on Friday, July 31st. Thankfully, there are no reported incidences of the Symbiq system being hacked.
US warns about spyware that many believe it wrote
Want to see a classic example of irony? Head to the US Computer Emergency Readiness Team (CERT) website. The government security group has issued a public warning about Regin... you know, the extra-sophisticated malware that many suspect the US wrote to spy on telecom networks. It's more than a little amusing to see one agency warn about a problem the other may have created, although it raises a few questions when there haven't been similarly direct warnings for (allegedly) state-created attacks like Stuxnet and Duqu. Is it evidence that the US wasn't involved, or that Regin is out of control? An attempt to throw people off the scent? Or something else?
Researcher finds vulnerability in WPS protocol, looks for manufacturers to offer fix
On the plus side, your router's mostly secure. Security researcher Stefan Viehbock has just discovered a major security hole which allowed him to use a brute force technique to access a WPS PIN-protected network in about two hours. According to Viehbock, a design flaw allows the WPS protocol's 8-digit PIN security to fall dramatically as additional attempts are made. With each attempt, the router will send a message stating whether the first four digits are correct while the last digit of the key is used as a checksum and then given out by the router in negotiation. As a result, the 100,000,000 possibilities that the WPS should represent becomes roughly to 11,000. The US-CERT has picked up on this and advised users to disable WPS on their routers. Viehbock, in turn, claims to have attempted to discuss the vulnerability with hardware vendors such as Buffalo, D-Link, Linksys, and Netgear, but says he has been roundly ignored and that no public acknowledgement of the issue has been released. As a possible final step, Viehbock has promised to release a brute force tool soon, thereby pushing the manufacturers to work to resolve the issue. In other news, that evil supercomputer from the movie War Games just got a few more digits of the nuclear launch codes -- maybe one of Stefan's pals can look into that one.
WebGL flaw leaves GPU exposed to hackers
Google spent a lot of time yesterday talking up WebGL, but UK security firm Context seems to think users should disable the feature because it poses a serious security threat, and the US Computer Emergency Readiness Team (CERT) is encouraging people to heed that advice. According to Context, a malicious site could pass code directly to a computer's GPU and trigger a denial of service attack or simply crash the machine. Ne'er-do-wells could also use WebGL and the Canvas element to pull image data from another domain, which could then be used as part of a more elaborate attack. Khronos, the group that organizes the standard, responded by pointing out that there is an extension available to graphics card manufacturers that can detect and protect against DoS attacks, but it did little to satisfy Context -- the firm argues that inherent flaws in the design of WebGL make it very difficult to secure. Now, we're far from experts on the intricacies of low-level hardware security but, for the moment at least, there seems to be little reason for the average user to panic. There's even a good chance that you're not vulnerable at all since WebGL won't run on many Intel and ATI graphics chips (you can check by clicking here). If you're inclined to err on the side of caution you can find instructions for disabling WebGL at the more coverage link -- but come on, living on the cutting edge wouldn't be anywhere near as fun if it didn't involve a bit of danger. [Thanks, Tony]
